skysight-inc/HackerNews huggingface dataset:
How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades.

If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys?

I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4?

With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?
You could argue that in that case the people deserving the most blame would be the people in charge for that country's medical system not having implemented proper antibiotic discipline to qualify for the antibiotic.

The same rules would have to apply to all.
I wouldn't be surprised if some (American) corporate lobbying was performed for this to be pushed through this way but given the numerous stories of how the CCP have practically _bullied_ their way into our markets with cheap(er) goods and/or services through state-sponsored subsidies, I would imagine that this is becoming the global response to a long-winded draw-down on the lessons of repercussions and self-reliance.
The 3-body problem trilogy (Rememberance of the Earth's past). My first sci-fi novels ever - the Netflix show sold me and these novels compelled me on a whole new hard sci-fi rabbit hole.

Presumed Innocent (preceeded by the Apple TV show of same name). Murder mystery. Loved it.

Tie-in novels from videogame franchise:

- Deus Ex: Black Light

- Devil May Cry: before the nightmare

I've also started Marvel Comics in anticipation of Fantastic Four and the whole Secret Wars storyline it will build up.

Couldn't finish a single non-fiction this year, but enjoyable so far:

- Zero to One

- When I say no, I feel guilty

- Designing data-intensive applications
> A turbine blade or a few coming off can have the same effect as a bomb going off near the plane.

Not in any passenger jet Embraer would get caught dead making. To my knowledge, most jet engines that are parallel to passenger sections require cowling that is reinforced to withstand a blade going loose.
The point generalises beyond semicolons; everything you leave to context is something other people have to load up the context for in order to understand.

Consider Python; if there are the optional type hints, those can tell you the third parameter to a function is optional. If those are missing, you need to dive into the function to find that out; those type hints are entirely optional, and yet they reduce the cognitive load of anyone using it.
Also, another day, another mostly AI-written article on HN's top page :)
Team america, world police?

Or Team America, child-minder?
Can Django with vanilla gunicorn do this ?
Accepted cryptography is also security through obscurity. The thing is that the amount of obscurity must be quantified. Cryptanalysis allows one to calculate these quantities of "obscurity." Then, a full study of effectiveness combines that with the costs associated with brute-forcing the bounds arrived at by the cryptanalysis.

Other parts of infosec are the same, but often with less well-quantified measures of effectiveness. E.g. memory hardening techniques like FORTIFY_SOURCE and MTE are effective in raising the difficulty of exploiting memory vulnerabilities, but under some conditions the vulnerabilities may still be exploitable.

Before using labels like "security through obscurity" one has to first answer: how much does the technique raise the cost for attackers? This is what articles about security systems (including this one) should focus on. In the end, hacking, like most things, comes down to economics.
No, everything was very manual and in SQL stored procedures. The job was looking for a JavaScript developer. When they laid me off I really didn’t miss the work.

After that I made a promise to myself that I wouldn’t do JavaScript for employment ever again because in absolutely every corporate JavaScript job, over 15 years of experience, everyone tried to hide from the code behind layers of unnecessary abstractions. I got tired of the negligent incompetence and extreme insecurity of people fumbling over the work.

Now I do something different.
pISSStream is already a quantum application as I wrote it while in a box with a poison gas system that can be triggered by the decay of a radionuclide, allowing me to be in a superposition of being alive and dead – technically the app both exists and doesn't exist.

I'm 100% certain this is how quantum computation works and am available for department chair positions and speaking engagements for conferences.
> When you see someone probing every single port on the box, you know they’re either a bad actor

That is not what the tool is for though... It is a tool specifically made to hinder... IDK... Making any information out of an NMAP scan?
It feels inevitable that computer security will continue evolving towards "active defense" typified by approaches like the above. Look at how complex and many-layered your immune system is, and consider that eventually your computer and/or network will resemble that as well.
Ireland embraced AI data centers, now they're consuming too much of its energy
Security through obscurity is somewhat helpful even though it can be defeated. Take camouflage and honeypots for example. It would probably be unwise to use this without a thorough audit of the code however.
Ah, is this why VRR displays start to flicker once your framerate drops too low? I had always wondered if it was a physical property of LCDs
Swimming! I started going 2x a week. I took lessons as a kid but hated it due to a fear of water after a traumatic experience in the deep-end. I don't have that fear anymore and I really enjoy it now. I can tread water! And I can float! The mechanics of swimming and floating make a lot of sense to me now. Now I'm swimming laps to find a technique that lets me swim the longest for the least amount of energy. Mostly I copy the techniques of older folks who are also swimming laps in the lanes next to me. lol.

I figure if the game I'm working on doesn't pan out then I'll go become a sailor or something. I think thats what I'm training for, potential career change.
Text lectures about string matching algorithms
If you don’t have an image that adds useful information to your document, don’t add an image at all. People on slow or metered connections will thank you.
Shepherding Electric Minds: My AI Dream Stack
LLMs do very poorly at judging the truth of long-term myths. When something has been asserted confidently on the internet over a long enough period of time it becomes baked into the weights, regardless of truth.

I provided a source from a religious studies scholar on Christmas trees specifically (one of the most frequently-cited "pagan" traditions). If you can point me to something with similar provenance I'll read it, but I'm not going to waste time on LLM responses.
I took digital electronics when I was in high school. Some classmates wrote a version of “The 12 Days of Christmas” except with names of chips instead of the usual gifts.

The only line I can remember is “Five 555s”
It's funny too how they exist in the same kinds of spaces they used to. Chat rooms, forums and other areas no one ever talks about anymore with the Twitters, TikToks and so forth dominating most social media attention.
I was pleased to see something properly technical, given that that is the supposed focus of this forum. I Hadn't ever heard of CPS as an IR, only SSA, and it was very interesting to learn about it.
>Most Indians cannot think beyond money, sex, and survival — just what you would expect of a society with an average IQ of 77.

A tad racist here?
Contrast with how they do in the US: https://www.reddit.com/r/coolguides/comments/11h2fc0/median_...
Slang is a new shader language with NVIDIA's involvement that can compile to multiple other target shader languages for portability.
How much do you think this tool raises the cost for attackers?
I see, is that simply due to wanting to commercialize the product?
The quintessential project for programming newbies. I implemented it when studying Haskell.

https://github.com/vladov3000/boids-hs
Does the canal make a fjord if one forgets to finish it?
All the responses look legitimate though, so even if someone does hit that MySQL, they'll be hard pressed determining it's not part of the noise of the other 65.5k legitimate-seeming responses. They'll just be wasting resources trying to get beyond such a broad surface to gain any depth. And if they already know to target MySQL (or any other particular service), it's all moot in any case, but also they wouldn't be doing a spectrum scan.
Well considering the incident happened in Kazakhstan, one might imagine Kazakhstan has air defences too...
Not by default - some things like /etc/machine-id or SSH keys are not a part of your configuration and they're just generated in place and kept untouched. Plus you (or your software) can litter arbitrary files and they'll stay. And of course $HOME is a mess.

But with impermanence it can be effectively immutable.
:)
Yeah I think I just need courage to say it’s good enough.
One is messengers. I believe that Signal and similar modern systems (like MLS) do what they do better than PGP, because of forward secrecy.

But acknowledging the fact that I receive a lot of emails from a lot of services, it feels like it would be nice if those services had an option to encrypt the emails they send me with PGP. That way my email provider would not have access to their content, right?
Luigi Mangione Prosecutors Have a Jury Problem: 'So Much Sympathy'
Manually streaming a XHR and parsing the messages is significantly more work, and you lose the built-in browser API. But if you use a fetch ReadableStream with TLV messages I'm sold.
To make 10 year copyright work with software, we would probably need to force companies to release the source code when the copyright expires. That way we keep an even playing field. Otherwise I think everything related to open source code would work out fine.
It does not matter if function foo is reused, only if the code inside foo that is to be pulled into new function bar is.
https://shader-slang.com/

It is a shader language
I mean I share the sentiment against low quality food and its effect on health, as probably everybody who eats there is also probably aware of too, but again, this is not the time or the place...
What can be said for those whom throw the "you bought it, you own it" over "nah, you're really just renting it afterall" arguments?
NASA Might Change Under Donald Trump
We don't. But we also don't know that they were, and we don't have enough quality evidence in favor of that hypothesis to justify the confidence with which it is asserted.

In the absence of evidence about the timing being affected by other festivals and in the presence of much evidence that all the actual traditions are far more recent than pagan, I don't believe it's fair to claim Christmas has pagan origins. The absolute best we can do is say that its timing may have been influenced by other, pre-Christian celebrations.
% cat test.c
main () {
int x
x=1
}
% gcc test.c
test.c:1:1: warning: type specifier missing, defaults to 'int' [-Wimplicit-int]
main () {
^
test.c:2:8: error: expected ';' at end of declaration
int x
^
;
1 warning and 1 error generated.
Valid point, it’s even mandatory in this case. Sometimes people do it for the sake of it. Maybe because there nothing else to make them feel important ?
In critical systems I hope it’s the case though
Nice. How old is the bike and how long has it been sitting? I recently tried to restore a old 92 Honda CBR600F2 that had also been sitting "far too long". Ended up spending almost as much as I paid for it due to my dumb butt leaving gas in it, ended up needing way more than its carbs cleaned out(surprise :p).

Called it quits at that point unfortunately although I am looking to get another bike for similar reasons, don't really care what kind as long as it isn't a hog if you have any recommendations!
It can be done. Sometimes.

I am so proud and happy, when I can make a seemingly complicated change quickly, because the architecture was well designed and everthing neatly seperated.

Most of the time though, it is exactly like you described. Or randalls good code comic:

https://xkcd.com/844/

Allmost too painful to be funny, when you know the pain is avoidable in theory.

Still, it should not be an excuse to be lazy and just write bad code by default. Developing the habit of making everything as clean, structured and clear as possible allways pays of. Especially if that code, that was supposed to be a quick and dirty throw away code experiment somehow ended up being used and 2 years later you suddenly need to debug it.
(I just experienced that joy)
Why should “we” have anything to do with a flight between Azerbaijan and Russia that crashed in Kazakhstan?
There is an issue of reading a code that is written by somebody else. If it's not in a common style, the cognitive load of parsing how it's done is an overhead.

The reason I used to hate Perl was around this, everyone had a unique way of using Perl and it had many ways to do the same thing.

The reason I dislike functional programming is around the same, you can skin the cat 5 ways, then all 5 engineers will pick a different way of writing that in Typescript.

The reason I like Python more is that all experienced engineers will eventually gravitate towards the idea of Pythonic notion and I've had colleagues whose code looked identical to how I'd have written it.
> The question is, who shot the plane? This part is pure speculation at this point.

It doesn't seem to be too difficult to put together what is likely. Grozny was under active drone attack at the time with air defenses working. And Russian air defense crews are pretty infamous for the jumpy trigger fingers at this point.
But, when buying those stocks, you're paying for perfect execution. If profit growth doesn't meet expectations, there's a lot of room for the valuation (and the stock price) to fall.
How does it make the models less suitable? Wouldn't more high quality source code help improve it? If it was closed source entirely it couldn't be trained on.
Does `it` conflict with Rspec's `it`? Surely they've thought of this, but to my eye it looks like it would get confusing.
Everything I Know About Driving in NYC
> The actual use cases for PGP are few and far between.

I use https://www.passwordstore.org/ with a hardware key on multiple OSes (including Linux, Android and macOS). I don't know of a better alternative to that.

No, I don't want to use 1Password. I want the UX of passwordstore. And I want to be able to somehow trust the password manager I use (if it comes from a random repo on the Internet, it's harder), and to somehow trust that it will still work in a few years. PGP has been around for decades, it feels pretty official and it should stay for a while, given that people have been trying to kill it for decades and complain that it can't seem to die :-).
Ruby. I've done a range of languages, for example C, pascal, java, VB, PHP, javascript. But Ruby seems distinct from all of them in both syntax and concept (hashes, etc). I'd like to get to a point where I have a confidence that the programs I write are using efficient data structures and algorithms.
Geochemical surveys reveal King Solomon's mines did not pollute environment
It diverted to Aktau after getting hit (by birds allegedly, but really - SAM). All other flights got diverted to Aktau too on that day.
> But choosing Haskell or a lisp (maybe I can exclude Clojure somewhat) at work? No, no and no.

I've been using CL at work for pretty much my entire career and have always gotten a huge amount of leverage from it.
> You seem to look at it as if we benefit nothing from the cause of the problem.

I haven’t said anything even remotely like that.

Of course the benefits have outweighed the costs so far. The whole thing is just getting started. The costs are nearly zero so far. Total warming was under 1C until a few years ago. We’re looking at something like 4C of warming with current trends. Projected warming with current emissions reduction pledges is 2.8C and it’s very unlikely that those pledges will be met. The harms are almost entirely in the future. Things will get much worse before they get better.

Or as the kids like to say, we were born at the end of the Fuck Around century and now we’re in the Find Out century.
The aircraft was sent away / prohibited from landing after reporting the explosion over Grozny, and had to divert to Kazakhstan to land without real pitch control.

Some view the denying of emergency landing clearance as an effort to destroy/obscure evidence: https://x.com/DailyTurkic/status/1872008574878298418
In a just and sane world, we would have pensions, locking up retirement savings away from human impulses and bad decisions. But here we are, doing our best to get through the shit show, surprised when humans do humans things.
I didn't say that at all, and if you do even the most cursory reading of restorative justice you'd know it's pretty much the opposite of "telling victims to 'just get over it'".
As someone who went down this path many years ago, I think the GTK numbers in the article are a bit misleading. You wouldn't create 1000 buttons to do a flamegraph properly in GTK.

In Sysprof, it uses a single widget for the flamegraph which means in less than 150 mb resident I can browse recordings in the GB size range. It really comes down to how much data gets symbolized at load time as the captures themselves are mmap'able. In nominal cases, Sysprof even calculates those and appends them after the capture phase stops so they can be mmap'd too.

That just leaves the augmented n-ary tree key'd by instruction pointer converted to string key, which naturally deduplicates/compresses.

The biggest chunk of memory consumed is GPU shaders.
Efficiency isn’t the goal of writing ruby. I think “thinking in ruby” can be expansive to you, but “how do I program efficient ruby” is actually antithetical to that.
>Tesla has an 8-year, 100,000 mile warranty on its battery packs, and there’s still a good bit of that battery warranty remaining on this particular car, assuming Tesla will honor it on a used rental car.

This feels like a load-bearing assumption that makes or breaks the thesis of the article that deserves more than being an assumption.

The model 3 warranty on Tesla's website does say that it covers ownership transfer, but who knows what language is in the Hertz purchase agreement.
There are reports of GPS jamming in the area (presumably as part of the Ukraine war). It seems plausible the pilots got lost.

Also, the time between the 'bird strike' and the crash is 20+ minutes, so they might have been trying to fly towards an airport with a larger runway or better emergency crews. Or maybe just an airport where repair crew were stationed to fix whatever was wrong with the plane.
Sure, but nothing stops you from looking at the raw code. Consider looking at compiled code. You can always hexdump the object file, but have a disassembly helps a lot.
50 Years Ago: Celebrating the Influential Intel 8080
I'm always unbelievably pissed off when I reserve a premium tier of car at SFO for a business trip, and Hertz tries to stick me with a Tesla, as if it is a premium car (horrible interior build quality), and with the assumption I have time to install apps and figure out how to use car charging infrastructure.
super interesting "short/long" slider on the right -- what made you come up with this UI concept?
Encapsulation is the good part of object-oriented programming for precisely this reason, and most serious software development relies heavily on encapsulation. What's bad about OOP is inheritance.

Microservices (in the sense of small services) are interesting because they are good at providing independent failure domains, but add the complexity of network calls to what would otherwise be a simple function call. I think the correct size of service is the largest you can get away with that fits into your available hardware and doesn't compromise on resilience. Within a service, use things like encapsulation.
I am calling 2025 the Year to Just Keep Swimming to get me to do some simple things over and over, but also to get back into swimming.
I agree but I also would be interested to see any proof for the claims you're talking about with regards to Christmas not having any pagan roots, where are you finding this information or rather, where can I read more?
Why that far? It's at least twice further from either beginning or destination than those are apart themselves.
Even the within article istself he is not coherent in his logic - oil production is going down due to reduced demand, not because it is scarce. That wind is too expensive is also simply not true - it’s cost per kWh is also constantly decreasing. The picture of a washing machine bike representing the future of Europe smells a lot like it was cooked up in Russian disinfo mills. Not a good look, El Pais.
That was a typo, the file was duckdb_static.a
IT is growing up gradually. It's only had a few decades to worry about security and I've seen most of them.

One day, IT will become time served but not today.
The plane crashed in Kazakhstan. It was shot over Russia. It was still sufficiently airworthy to make quite a distance before crashing.
That’s why I strangely love some closed enterprise solutions. They are anti-fun, non-extensible behemots that you can learn in around five years and then it’s basically all free. If you can stand everything else, ofc.

The open source world could learn from that, by holding up on spiral rotation of ideas (easily observable to turn 360 in under a decade) and not promoting techniques that are not fundamental to a specific development environment. E.g. functional or macro/dsl ideas in a language that is not naturally functional or macro/that-dsl by stdlib or other coding standards. Or complex paradigms instead of few pages of clear code.

Most of it comes from the ability to change things and create idioms, but this ability alone doesn’t make one a good change/idiom designer. As a result, changes are chaotic and driven by impression rather than actual usefulness (clearly indicated by spiraling). Since globally there’s no change prohibition, but “mainstream” still is a phenomenon, the possibility of temperate design is greatly depressed.
I was curious - land use stats in the US show agricultural use has dropped from 49% to 45% in the last 60 years, with the majority of the loss in the 90s and early 60s. Basically zero change in the last 20 years. https://data.worldbank.org/indicator/AG.LND.AGRI.ZS?location...

It looks like there's about 20x more ag land, by sq km, than urban land in the US (4M to about 200k). So even if urban areas doubled in size, purely at the expense of ag (and not forests), it would be about 5% loss overall.

I have a feeling these numbers don't account for suburban land use, and that's actually an issue... Not urban use.
Maybe in your field the definition of cognitive load has a very specific, academic meaning. This article wasn’t meant for you.
replace Wordpress
Ashtanga Yoga
It does, but IMAP is clearly not a priority, and they certainly aren't interested in JMAP. They support IMAP (with caveats) because you can't really offer e-mail without IMAP, but they want you to use their GMail app.
If the world put even a tenth of the effort into training Lisp programmers as it does into training Java programmers you would have no trouble marshaling an army of Lisp programmers.